CVE-2026-61554: JM33-m0 EMP3R0R

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.

Affected products

• JM33-m0 EMP3R0R: before 4.2.5 (fixed in 4.2.5)

Published 2026-09-15. Last modified 2026-09-30.